Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 05:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_2d0ca37ff3b5dbd29f0e2c7790b0e21f_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-19_2d0ca37ff3b5dbd29f0e2c7790b0e21f_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_2d0ca37ff3b5dbd29f0e2c7790b0e21f_mafia.exe
-
Size
487KB
-
MD5
2d0ca37ff3b5dbd29f0e2c7790b0e21f
-
SHA1
390460b9e8fb7e6f4b69688c13c10bfc44691eb6
-
SHA256
7f53c1d7d0c0c79c53e800036c805dd442ffd3d352d85e20ab34755bbbe6dc95
-
SHA512
be06bec24e4996234fb8951afa4d8db12096aa1008b08e68322838aae663b67dd24994caeb5d475f2d8a30b0e87fa71b78503ed7c4f609b7263fe1d34aba875e
-
SSDEEP
12288:HU5rCOTeiJbzFz9/Nn+kAaVaKm+Cg+U4NZ:HUQOJJ3DdB04+U4N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4612 CB4F.tmp 4764 CBBC.tmp 4460 CC29.tmp 1676 CC97.tmp 3820 CD23.tmp 3644 CD81.tmp 2756 CDDF.tmp 3428 CE4C.tmp 3972 CEBA.tmp 4972 CF17.tmp 4940 CF75.tmp 3840 CFE3.tmp 3172 D031.tmp 2236 D0AE.tmp 2152 D10B.tmp 4944 D169.tmp 1852 D1E6.tmp 4052 D244.tmp 2256 D292.tmp 3992 D2FF.tmp 1196 D35D.tmp 3608 D3AB.tmp 4396 D409.tmp 3272 D467.tmp 3100 D4C5.tmp 3744 D551.tmp 3920 D5AF.tmp 2360 D61C.tmp 2468 D699.tmp 4992 D707.tmp 2024 D784.tmp 432 D7F1.tmp 4180 D86E.tmp 5024 D8BC.tmp 1208 D90A.tmp 3416 D958.tmp 2312 D9B6.tmp 4104 DA04.tmp 3028 DA62.tmp 3560 DAC0.tmp 2640 DB1E.tmp 840 DB6C.tmp 1260 DBBA.tmp 1304 DC08.tmp 1772 DC66.tmp 3316 DCA4.tmp 2484 DCF2.tmp 2416 DD40.tmp 4704 DD9E.tmp 4564 DDFC.tmp 4508 DE4A.tmp 4968 DE98.tmp 2700 DEE6.tmp 1820 DF34.tmp 3472 DF92.tmp 3400 DFE0.tmp 4288 E02E.tmp 4384 E07D.tmp 4368 E0CB.tmp 1548 E119.tmp 4924 E167.tmp 4088 E1A5.tmp 3756 E1F4.tmp 824 E242.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1095.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4438.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E242.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E441.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B06F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9045.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A459.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2362.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3436 wrote to memory of 4612 3436 2024-09-19_2d0ca37ff3b5dbd29f0e2c7790b0e21f_mafia.exe 82 PID 3436 wrote to memory of 4612 3436 2024-09-19_2d0ca37ff3b5dbd29f0e2c7790b0e21f_mafia.exe 82 PID 3436 wrote to memory of 4612 3436 2024-09-19_2d0ca37ff3b5dbd29f0e2c7790b0e21f_mafia.exe 82 PID 4612 wrote to memory of 4764 4612 CB4F.tmp 83 PID 4612 wrote to memory of 4764 4612 CB4F.tmp 83 PID 4612 wrote to memory of 4764 4612 CB4F.tmp 83 PID 4764 wrote to memory of 4460 4764 CBBC.tmp 84 PID 4764 wrote to memory of 4460 4764 CBBC.tmp 84 PID 4764 wrote to memory of 4460 4764 CBBC.tmp 84 PID 4460 wrote to memory of 1676 4460 CC29.tmp 85 PID 4460 wrote to memory of 1676 4460 CC29.tmp 85 PID 4460 wrote to memory of 1676 4460 CC29.tmp 85 PID 1676 wrote to memory of 3820 1676 CC97.tmp 86 PID 1676 wrote to memory of 3820 1676 CC97.tmp 86 PID 1676 wrote to memory of 3820 1676 CC97.tmp 86 PID 3820 wrote to memory of 3644 3820 CD23.tmp 87 PID 3820 wrote to memory of 3644 3820 CD23.tmp 87 PID 3820 wrote to memory of 3644 3820 CD23.tmp 87 PID 3644 wrote to memory of 2756 3644 CD81.tmp 88 PID 3644 wrote to memory of 2756 3644 CD81.tmp 88 PID 3644 wrote to memory of 2756 3644 CD81.tmp 88 PID 2756 wrote to memory of 3428 2756 CDDF.tmp 89 PID 2756 wrote to memory of 3428 2756 CDDF.tmp 89 PID 2756 wrote to memory of 3428 2756 CDDF.tmp 89 PID 3428 wrote to memory of 3972 3428 CE4C.tmp 90 PID 3428 wrote to memory of 3972 3428 CE4C.tmp 90 PID 3428 wrote to memory of 3972 3428 CE4C.tmp 90 PID 3972 wrote to memory of 4972 3972 CEBA.tmp 91 PID 3972 wrote to memory of 4972 3972 CEBA.tmp 91 PID 3972 wrote to memory of 4972 3972 CEBA.tmp 91 PID 4972 wrote to memory of 4940 4972 CF17.tmp 92 PID 4972 wrote to memory of 4940 4972 CF17.tmp 92 PID 4972 wrote to memory of 4940 4972 CF17.tmp 92 PID 4940 wrote to memory of 3840 4940 CF75.tmp 93 PID 4940 wrote to memory of 3840 4940 CF75.tmp 93 PID 4940 wrote to memory of 3840 4940 CF75.tmp 93 PID 3840 wrote to memory of 3172 3840 CFE3.tmp 94 PID 3840 wrote to memory of 3172 3840 CFE3.tmp 94 PID 3840 wrote to memory of 3172 3840 CFE3.tmp 94 PID 3172 wrote to memory of 2236 3172 D031.tmp 95 PID 3172 wrote to memory of 2236 3172 D031.tmp 95 PID 3172 wrote to memory of 2236 3172 D031.tmp 95 PID 2236 wrote to memory of 2152 2236 D0AE.tmp 96 PID 2236 wrote to memory of 2152 2236 D0AE.tmp 96 PID 2236 wrote to memory of 2152 2236 D0AE.tmp 96 PID 2152 wrote to memory of 4944 2152 D10B.tmp 97 PID 2152 wrote to memory of 4944 2152 D10B.tmp 97 PID 2152 wrote to memory of 4944 2152 D10B.tmp 97 PID 4944 wrote to memory of 1852 4944 D169.tmp 98 PID 4944 wrote to memory of 1852 4944 D169.tmp 98 PID 4944 wrote to memory of 1852 4944 D169.tmp 98 PID 1852 wrote to memory of 4052 1852 D1E6.tmp 99 PID 1852 wrote to memory of 4052 1852 D1E6.tmp 99 PID 1852 wrote to memory of 4052 1852 D1E6.tmp 99 PID 4052 wrote to memory of 2256 4052 D244.tmp 100 PID 4052 wrote to memory of 2256 4052 D244.tmp 100 PID 4052 wrote to memory of 2256 4052 D244.tmp 100 PID 2256 wrote to memory of 3992 2256 D292.tmp 101 PID 2256 wrote to memory of 3992 2256 D292.tmp 101 PID 2256 wrote to memory of 3992 2256 D292.tmp 101 PID 3992 wrote to memory of 1196 3992 D2FF.tmp 102 PID 3992 wrote to memory of 1196 3992 D2FF.tmp 102 PID 3992 wrote to memory of 1196 3992 D2FF.tmp 102 PID 1196 wrote to memory of 3608 1196 D35D.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_2d0ca37ff3b5dbd29f0e2c7790b0e21f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_2d0ca37ff3b5dbd29f0e2c7790b0e21f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\CD23.tmp"C:\Users\Admin\AppData\Local\Temp\CD23.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\CF17.tmp"C:\Users\Admin\AppData\Local\Temp\CF17.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\CF75.tmp"C:\Users\Admin\AppData\Local\Temp\CF75.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\D244.tmp"C:\Users\Admin\AppData\Local\Temp\D244.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\D35D.tmp"C:\Users\Admin\AppData\Local\Temp\D35D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"23⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"24⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\D467.tmp"C:\Users\Admin\AppData\Local\Temp\D467.tmp"25⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"26⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\D551.tmp"C:\Users\Admin\AppData\Local\Temp\D551.tmp"27⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"28⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\D61C.tmp"C:\Users\Admin\AppData\Local\Temp\D61C.tmp"29⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"30⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"31⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\D784.tmp"C:\Users\Admin\AppData\Local\Temp\D784.tmp"32⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"33⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\D86E.tmp"C:\Users\Admin\AppData\Local\Temp\D86E.tmp"34⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"35⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"36⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\D958.tmp"C:\Users\Admin\AppData\Local\Temp\D958.tmp"37⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"38⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"39⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"40⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"41⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"43⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"44⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\DC08.tmp"C:\Users\Admin\AppData\Local\Temp\DC08.tmp"45⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"46⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"47⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"48⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\DD40.tmp"C:\Users\Admin\AppData\Local\Temp\DD40.tmp"49⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"50⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"51⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"52⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"53⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"54⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\DF34.tmp"C:\Users\Admin\AppData\Local\Temp\DF34.tmp"55⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\DF92.tmp"C:\Users\Admin\AppData\Local\Temp\DF92.tmp"56⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"57⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\E02E.tmp"C:\Users\Admin\AppData\Local\Temp\E02E.tmp"58⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\E07D.tmp"C:\Users\Admin\AppData\Local\Temp\E07D.tmp"59⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"60⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\E119.tmp"C:\Users\Admin\AppData\Local\Temp\E119.tmp"61⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"62⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"63⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"64⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\E242.tmp"C:\Users\Admin\AppData\Local\Temp\E242.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:824 -
C:\Users\Admin\AppData\Local\Temp\E29F.tmp"C:\Users\Admin\AppData\Local\Temp\E29F.tmp"66⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:184 -
C:\Users\Admin\AppData\Local\Temp\E33C.tmp"C:\Users\Admin\AppData\Local\Temp\E33C.tmp"68⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"69⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"70⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\E445.tmp"C:\Users\Admin\AppData\Local\Temp\E445.tmp"71⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"72⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"73⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"74⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\E59D.tmp"C:\Users\Admin\AppData\Local\Temp\E59D.tmp"75⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"76⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"77⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\E697.tmp"C:\Users\Admin\AppData\Local\Temp\E697.tmp"78⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"79⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"80⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"81⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"82⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"83⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"84⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"85⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"86⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"87⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"89⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"90⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"91⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"92⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"93⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\EC25.tmp"C:\Users\Admin\AppData\Local\Temp\EC25.tmp"94⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\EC73.tmp"C:\Users\Admin\AppData\Local\Temp\EC73.tmp"95⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"96⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"97⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"98⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"99⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"100⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"101⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"102⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\EF42.tmp"C:\Users\Admin\AppData\Local\Temp\EF42.tmp"103⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"104⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"105⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\F05B.tmp"C:\Users\Admin\AppData\Local\Temp\F05B.tmp"106⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\F0A9.tmp"C:\Users\Admin\AppData\Local\Temp\F0A9.tmp"107⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"108⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\F145.tmp"C:\Users\Admin\AppData\Local\Temp\F145.tmp"109⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"110⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\F201.tmp"C:\Users\Admin\AppData\Local\Temp\F201.tmp"111⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\F25F.tmp"C:\Users\Admin\AppData\Local\Temp\F25F.tmp"112⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"113⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\F30B.tmp"C:\Users\Admin\AppData\Local\Temp\F30B.tmp"114⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"115⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"116⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"117⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\F462.tmp"C:\Users\Admin\AppData\Local\Temp\F462.tmp"118⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"119⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"120⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\F55C.tmp"C:\Users\Admin\AppData\Local\Temp\F55C.tmp"121⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"122⤵PID:3472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-